Cybercrime investigators are examining whether patient data was improperly shared after a NSW Health nurse was charged over an alleged data breach involving the unauthorised access and download of patient records.
The nurse has since been stood down by the Northern Sydney Local Health District.
On 22 July, police received a report that a NSW Health employee had allegedly accessed and downloaded patient data without authorisation.
Three days later, Cybercrime Squad detectives charged a 59-year-old registered nurse following an investigation into an alleged data breach.
The man, who was employed by the Northern Sydney Local Health District, was taken in by authorities to the Manly Police Station where he was charged with “access/modify restricted data held in computer”.
This charge – which carries a maximum penalty of two years’ imprisonment – relates to the act of accessing or modifying data which is guarded by protective measures (such as passwords) on a computer system.
Neither NSW Health or NSW Police have publicly verified the amount of data allegedly downloaded by the 59-year-old.
Detective superintendent Matt Craft, commander of Cybercrime Squad, said a series of confiscated “devices” were being examined by specialists to determine whether there has been “any further sharing of the data”.
“Initial inquiries indicate the data – while being accessed illegally – appears to have been contained to the individual,” said Craft.
“Incidents such as this alleged access represents a clear breach of professional and community trust, and it will be treated with the utmost seriousness.
“NSW Police will continue to work collaboratively with NSW Health.”
Worker stood down following initial investigation
In a statement given to Information Age, a spokesperson for Northern Sydney Local Health District (NSLHD) said a staff member has been "stood down and has no further access to NSW Health systems or facilities".
"NSLHD would like to reassure patients this is not a cyber security attack," they said.
The spokesperson also confirmed NSHLD was working to identify patients whose data may have been compromised as part of the alleged data breach.
"Should a breach be confirmed, we will contact them as soon as possible.
"Protecting the privacy and security of patient, staff and community information is a priority and we take incidents of this nature extremely seriously.
"As the matter is before the courts, it would be inappropriate to comment further at this stage."
Devices uncovered in Frenchs Forest
NSW Police said a search warrant was carried out at a home in Frenchs Forest, located in Sydney’s northern suburbs, at around 7.30pm on 23 July.
Detectives seized “several” electronic devices, which they will allege contained “details of patients”.
NSW Police did not specify when the data was allegedly downloaded, though Craft emphasised that NSW Health alerted police as soon as it identified the breach.
“The moment NSW Health alerted us to this breach, Cybercrime Squad detectives acted swiftly to seize the devices and recover the data,” said Craft.
When asked whether the allegedly compromised data included medical information, NSW Police directed Information Age to NSW Health.
Why steal the data?
Craig Costello, professor in the School of Computer Science at Queensland University of Technology, said medical records “are among the most valuable categories of personal data” because they contain “deeply personal information that individuals cannot simply reset or replace in the way they can a password or credit card number.”
Professor Craig Costello said medical data was among the most valuable as it cannot be simply reset or replaced, like a credit card. Photo: Supplied.
“This permanence makes healthcare data particularly attractive to criminals seeking to commit identity fraud, financial crime or highly targeted social engineering attacks,” Costello told Information Age.
He noted, however, that it is important to not assume all cases of unauthorised access to patient information are financially motivated.
“While organised criminal activity is a significant concern, incidents can also stem from curiosity, convenience, workplace grievances or poor judgement,” said Costello.
Evan Vougdis, head of cyber intelligence, response and recovery at Sydney-based cybersecurity firm NSB Cyber, also noted the value wasn’t just in the data itself.
“NSW Health systems hold categories of information that people would pay to keep private,” Vougdis told Information Age.
“[This includes] current addresses for people who work hard to stay off the public record.”
Vougdis, who routinely works on insider threat cases, explained not all workers who misappropriate confidential data are driven by money.
“In my experience the most common motive isn't money, it's curiosity,” he said.
“Someone looks up a neighbour, an ex, a colleague, a name they recognised on a patient list.
“Access on its own tells you almost nothing about intent.
"What separates a sticky-beak from a commercial motive is what happens next, and that's what a device examination is actually looking for.”
Costello added that insider threats are one of the most persistent challenges in cybersecurity and among the hardest to predict and defend against.
“Organisations should operate on the assumption that the potential for misuse exists,” said Costello.
“Effective security means limiting access to only what people need, monitoring for unusual behaviour or large data transfers, restricting unauthorised data movement, and responding quickly when anomalies are detected.
“In this case, rapid detection and response appear to have been key to limiting the impact.”
The accused NSW Health employee has been granted conditional bail to appear at Manly Local Court on 19 August.
